Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 12:36

General

  • Target

    17d359336bdd68246d4041036c5ab62f85f1a15cdad53095e3fe0203449752f0.exe

  • Size

    8.9MB

  • MD5

    11960e3e037341c6a3853c5654ba1b18

  • SHA1

    59e1bbe18ab48d8536abaf4ec44cd46321bc4c4f

  • SHA256

    17d359336bdd68246d4041036c5ab62f85f1a15cdad53095e3fe0203449752f0

  • SHA512

    8fb6872a74e24f79a66081bdf3b7220c571d65dfc70a32237ec71490e6138cd7e096c09d0945686da7c4417a8ae24af81bfc1a5294ea79094db0b838e296699a

  • SSDEEP

    196608:5LDeQYhr1uJ9jSOBIt0IrT+tk5sLU+hTKNMI9:hKmJJSQICIrT+tk56hTKNp9

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17d359336bdd68246d4041036c5ab62f85f1a15cdad53095e3fe0203449752f0.exe
    "C:\Users\Admin\AppData\Local\Temp\17d359336bdd68246d4041036c5ab62f85f1a15cdad53095e3fe0203449752f0.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c NetSh Advfirewall set allprofiles state off
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:8408
      • C:\Windows\SysWOW64\netsh.exe
        NetSh Advfirewall set allprofiles state off
        3⤵
        • Modifies Windows Firewall
        PID:8512
    • C:\Windows\SysWOW64\Windows Defender Firewall.exe
      "C:\Windows\System32\Windows Defender Firewall.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:8652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start "" "mlauncher.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:8708
      • C:\Users\Admin\AppData\Local\Temp\mlauncher.exe
        "mlauncher.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:8732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\mlauncher.exe

    Filesize

    6.2MB

    MD5

    e03c00628a68172dd5decb6fb02cd3e1

    SHA1

    f17a971b912c56a3f14de8c01c466d91a2a07b4d

    SHA256

    0be43e4a5649ea0540b774922c154a8cded6e9bbe0375a5745d19aaa87793741

    SHA512

    38d1b8b718230be1d806a0f956dae9ce461e15eeeb2b6b98da3e4d567f5fdf94a089ad423895610166f091ca67146f64a16596925276787fea3a5c33e16d97e5

  • \Windows\SysWOW64\Windows Defender Firewall.exe

    Filesize

    1.0MB

    MD5

    cfceec08193aaa1959ad3b8ad916b434

    SHA1

    f17372f7fea0e534ebceb5e74e2871e62d4d523c

    SHA256

    212604ea4159e7fe8f8a101aaa456c0198c0a75296079fc8d2fb14b28e1ff19e

    SHA512

    6b19a37bcefd06fd9d658b716b7face7eb187ba796a8933afde1c2c31bff4e096ca7390544bd00370c121da9a6741f66dcb799acc10f02c0c169eff66375618e

  • \Windows\SysWOW64\XYDsoftWpe.dll

    Filesize

    611KB

    MD5

    1ae8f19cf62d49f6a9919e78349aeb3a

    SHA1

    702be239f0e6b5009188d76eb9d58d987b1e9079

    SHA256

    5d8068037dc0bf29bc659ed47b33c20e40e14f60191485dadc1da49a4fbd6286

    SHA512

    d09223bb37f57df265443d83fd7b347951489fc7cc6591403ec7047587e6a4c175fbfdd4292b82cef15defcbaef6c79a29d54588212d60073c76b6c425c15448

  • \Windows\SysWOW64\nfapi.dll

    Filesize

    320KB

    MD5

    21964c506f808bb02b23e2bd3353398a

    SHA1

    e32953aadd504fed57b624b220bdf661a5e7e7bd

    SHA256

    8ed39eb9730c22055ea7906633a53250c6480a8cae9483224113502cdc3eeeef

    SHA512

    8e614cea2cbea50aaeb7694eac78f2b8d3a0b339f801f65ab47b8e021a133f2c73b8eaf3589cafbc61b3266b61e3ac2c2e03569ee8c8192685f00d1276ee7b2f

  • memory/2508-536-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-1-0x00000000752A0000-0x00000000752E7000-memory.dmp

    Filesize

    284KB

  • memory/2508-508-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-510-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-512-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-514-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-516-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-518-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-540-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-522-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-524-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-526-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-528-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-530-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-532-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-534-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-0-0x0000000000400000-0x0000000000F58000-memory.dmp

    Filesize

    11.3MB

  • memory/2508-538-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-520-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-564-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-554-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-546-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-548-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-550-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-552-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-544-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-556-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-558-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-562-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-560-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-506-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-7986-0x0000000010000000-0x000000001020B000-memory.dmp

    Filesize

    2.0MB

  • memory/2508-504-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-503-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/2508-16712-0x0000000000400000-0x0000000000F58000-memory.dmp

    Filesize

    11.3MB

  • memory/2508-8002-0x00000000052E0000-0x0000000005431000-memory.dmp

    Filesize

    1.3MB

  • memory/2508-542-0x0000000002C30000-0x0000000002D41000-memory.dmp

    Filesize

    1.1MB

  • memory/8652-8003-0x0000000000400000-0x0000000000551000-memory.dmp

    Filesize

    1.3MB